operator use for a combo box in vb.net - mysql

Question

this years is a sample of combo box. what should i do for this to have not error?`
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles save.Click
Dim genderval As String
Dim birthdate As String
birthdate = bday.Value.ToString()
If babae.Checked = True Then
genderval = "Female"
Else
genderval = "Male"
End If
query = "insert into studentinfo(Lastname,Firstname,middlename,birthdate,gender,age,studentyear,username,accountpassword,confirmpassword) values('" & familynem.Text & "','" & givennem.Text & "','" & middlenem.Text & "','" & birthdate & "','" & genderval & "','" & Edaad.Text & "','" *years* "','" & usename.Text & "','" & accpass.Text & "','" & confirmpass.Text & "')"
con.Open()
cmd = New SqlCommand(query, con)
cmd.ExecuteNonQuery()
con.Close()
dataReload()
user.Show()
Me.Hide()
End Sub
End Class

Answer 1

You need to access ComboBox by it's properties and not Directly
Use Years.Text or Years.SelectedValue instead of Years
Try this
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles save.Click
Dim genderval As String
Dim birthdate As String
birthdate = bday.Value.ToString()
If babae.Checked = True Then
genderval = "Female"
Else
genderval = "Male"
End If
query = "insert into studentinfo(Lastname,Firstname,middlename,birthdate,gender,age,studentyear,username,accountpassword,confirmpassword) values('" & familynem.Text & "','" & givennem.Text & "','" & middlenem.Text & "','" & birthdate & "','" & genderval & "','" & Edaad.Text & "','" Years.Text "','" & usename.Text & "','" & accpass.Text & "','" & confirmpass.Text & "')"
con.Open()
cmd = New SqlCommand(query, con)
cmd.ExecuteNonQuery()
con.Close()
dataReload()
user.Show()
Me.Hide()
End Sub
End Class

Answer 2

This kind of errors are common when you use a concatenation string. Somewhere one or more of your strings value contains an invalid character that breaks the syntax of the sql command.
For example, if one of your textboxes contains a single quote, the resulting query text would be invalid. Also, it is not clear what is years. If it is a combobox then you need to extract its value through the property Text (or SelectedValue, or SelectedItem). Another thing to be aware of is the matching between the parameters value and the underlying column datatype. They should be the same, so for integers fields you need to add a conversion from the textbox text (Age?)
The answer as usual are parameterized queries that remove this kind of errors and the Sql Injection vulnerability
query = "insert into studentinfo " & _
"(Lastname,Firstname,middlename,birthdate,gender,age," & _
"studentyear,username,accountpassword,confirmpassword) " & _
"values(#family,#given,#mname,#dob,#gender,#eda,#years,#uname,#pwd,#cpwd)"
con.Open()
// cmd = New SqlCommand(query, con)
cmd = new MySqlCommand(query, con)
cmd.Parameters.AddWithValue("#family",familynem.Text)
cmd.Parameters.AddWithValue("#given",givennem.Text)
cmd.Parameters.AddWithValue("#mname",middlenem.Text )
cmd.Parameters.AddWithValue("#dob",birthdate)
cmd.Parameters.AddWithValue("#gender",genderval )
cmd.Parameters.AddWithValue("#eda",Edaad.Text) ' or Convert.ToInt32(Edaad.Text)
cmd.Parameters.AddWithValue("#years",years.Text)
cmd.Parameters.AddWithValue("#uname",usename.Text )
cmd.Parameters.AddWithValue("#pwd",accpass.Text )
cmd.Parameters.AddWithValue("#cpwd",confirmpass.Text )
cmd.ExecuteNonQuery()
By the way, you have tagged this question with MySql but you are using a SqlCommand. What is the right database to use?